STKI Summit 2018 Cyber Governance Initiative

40
STKI’s Cyber
Governance initiative
Life is like riding a
bicycle.To keep
your balance, you
must keep
moving."
— Albert Einstein
STKI’s Cyber
Governance initiative
Page 1
STKI Company Confidential

41
41
It’s well known that so many
companies get hacked
Yet many executives believe it
will not affect them
Even the largest and most
prestigious ones
Page 2

42
Copyright@STKI_2018 Do not remove source or attribution from any slide or graph
4242
Cyber’s Problematic Reputation
“Cyber is holding us back from achieving all other initiatives”
Page 3

43
4343
Cyber governance initiative destination
Striking a balance between
the business needs and cyber,
risk & compliance needsCyber, governance & compliance are crucial for the survival of organizations
But they are also holding organizations back in many ways.
Executives don’t fully comprehend the importance of cyber security and their
personal responsibility.
Page 4

44
4444
Cyber Governance Initiative
Page 5

45
45
45
Demonstrate CEO
BOARD their cyber
responsibility
Determine business cyber
main principles
Allocate cyber budget,
head count & org.
structure
Trek name:
Zero trust security: Get top management on board
Page 6

46
4646
Source: STKI staffing report
Number of Employees/ Cyber personnel
Implement STKI’s market data &
best practices to receive
appropriate budgets and personnel!
Page 7

47
47
Build risk & cyber multi-
year program
Build cyber resilience
program
Trek name:
Design a Cyber Governance Plan
Design holistic cyber
measurement program
Use “Israel National Cyber
Directorate” guidance and tools
Page 8

48
4848
Israel National Cyber Directorate guidance
will boost cyber security in Israel!
Especially for non-regulated enterprises
Non-regulated CISO
I don’t have enough
budget and resources
I can’t explain this to the
CEOBoard
Page 9

49
49
49
Page 10

50
50
50
Organizations that want to participate in the betta program can contact tora@pmo.gov.il
Page 11

51
51
Don’t forget to secure the ENTIRE supply chain!
Page 12

52
52
STKI expects new regulation based on Israel National
Cyber Directorate guidance in several industries
Take a deep breath.We’ve only just started.
Page 13

53
5353
Of boards are not trained to
deal with cyber security incidents!
Source: Einat Meyron cyber resilience consultant & The Cyber Security Source - 2017
Page 14

54
5454
CEO board member nightmare:
One Innocent phone call
Page 15

55
5555
‫הגנה‬ ‫כלי‬ ‫איזה‬
‫מותקנים‬
‫אצלכם‬?
‫זה‬ ‫איך‬
‫קרה‬?
‫פיצוי‬ ‫יהיה‬
‫ללקוחות‬?
‫תוכלו‬ ‫שלא‬ ‫אומרים‬
‫ימים‬ ‫כמה‬ ‫לעבוד‬
‫יש‬‫תוכנית‬
‫חלופית‬?
‫הכנסתם‬
‫מו‬ ‫מנהל‬"‫מ‬
‫לתמונה‬?
‫אחריות‬
‫מי‬ ‫של‬?
‫לכם‬ ‫פרצו‬ ‫כבר‬
‫בעבר‬?
‫מייעץ‬ ‫מי‬
‫לכם‬?
‫זו‬ ‫אם‬ ‫ידוע‬
‫עבודה‬
‫פנימית‬?
‫את‬ ‫תפסיקו‬
‫המסחר‬
‫במניה‬?
‫רוצה‬ ‫אני‬
‫עם‬ ‫לדבר‬
‫המנכל‬
‫קיבלתם‬
‫איומים‬
‫מקדימים‬?
‫כמה‬
‫דורשים‬?
‫משפיע‬ ‫זה‬ ‫איך‬
‫הלקוחות‬ ‫על‬?
‫כי‬ ‫קרה‬ ‫זה‬
‫חסכתם‬
‫בעלויות‬?
‫כמה‬
‫מחשבים‬
‫נפגעו‬?
‫תעדכנו‬ ‫איך‬
‫אותנו‬?
‫היה‬ ‫איפה‬
‫הכשל‬?
‫המנכל‬ ‫אדוני‬,
‫תתפטר‬?
‫המלצות‬ ‫יישמתם‬
‫רגולטור‬?
‫לאחרונה‬ ‫מתי‬
‫את‬ ‫בדקתם‬
‫המערכות‬?
‫העובדים‬
‫שאין‬ ‫אומרים‬
‫מושג‬ ‫להם‬
‫קורה‬ ‫מה‬
‫תחזרו‬ ‫מתי‬
‫לפעילות‬?
‫איזה‬ ‫לכם‬ ‫ידוע‬
‫נדבקו‬ ‫מעגלים‬
‫בגללכם‬?
‫מידע‬ ‫נגנב‬
‫לקוחות‬ ‫של‬?
‫לא‬ ‫שלכם‬ ‫העובדים‬
‫לענות‬ ‫מה‬ ‫יודעים‬
‫ללקוחות‬
‫קשר‬ ‫יצרתם‬
‫עם‬‫ההאקר‬?
‫מוודאים‬ ‫הלקוחות‬ ‫איך‬
‫נפגעו‬ ‫שלא‬?
‫על‬ ‫משפיע‬ ‫זה‬ ‫איך‬
‫הדו‬"‫הרבעוני‬ ‫ח‬?
‫מיוחד‬ ‫משהו‬ ‫היה‬
‫בדרישה‬?
‫את‬ ‫כבר‬ ‫עדכנתם‬
‫להגנת‬ ‫הרשות‬
‫הסייבר‬?
‫צריכים‬ ‫לקוחות‬
‫תוכנה‬ ‫להתקין‬
‫אצלם‬ ‫חדשה‬?
‫ריגול‬ ‫זה‬
‫עסקי‬?
Source: Einat Meyron cyber resilience consultant
Page 16

56
5656
‫המפתח‬ ‫היא‬ ‫שגרה‬ ‫בזמן‬ ‫החלטות‬ ‫קבלת‬
‫המשבר‬ ‫את‬ ‫שינהל‬ ‫הצוות‬ ‫מי‬‫מייד‬‫מדווח‬ ‫כשהוא‬?
‫מתקפה‬ ‫בזמן‬ ‫יעיל‬ ‫לתפקוד‬ ‫הקריטיות‬ ‫השאלות‬ ‫מהן‬?
‫נמוכה‬ ‫סיכון‬ ‫ברמת‬ ‫יסווג‬ ‫ומה‬ ‫דרמה‬ ‫נחשב‬ ‫מה‬?
‫ביטוח‬ ‫פוליסת‬ ‫יש‬ ‫האם‬?‫אומרת‬ ‫היא‬ ‫מה‬?
‫יותר‬ ‫נרחב‬ ‫משפטי‬ ‫יעוץ‬ ‫נדרש‬ ‫האם‬?
‫מוכרים‬ ‫הרלוונטי‬ ‫לרגולטור‬ ‫הדיווח‬ ‫נהלי‬ ‫האם‬?
‫ה‬ ‫עם‬ ‫קשר‬ ‫לביסוס‬ ‫מהלכים‬ ‫נעשו‬ ‫האם‬-CERT‫הלאומי‬?
‫הספקים‬ ‫עם‬ ‫הקשר‬ ‫מנוהל‬ ‫איך‬‫הלקוחות‬‫המניות‬ ‫בעלי‬?
‫הכופר‬ ‫תשלום‬ ‫לאפשרות‬ ‫מתייחס‬ ‫הארגון‬ ‫איך‬?
‫הכופר‬ ‫לתשלום‬ ‫הכסף‬ ‫מגיע‬ ‫מאיפה‬?
Source: Einat Meyron cyber resilience consultant
Page 17

57
5757
Leverage the similarities between BCP & Cyber Resilience
BCP
(Business
Continuity Plan)
Cyber
Resilience
And make them work together in collaboration
Page 18

58
5858
Trek name:
Adopt to changing regulations
Keep up with existing
regulations
Look as GDPR
becomes standard
Implement Privacy
Protection Regulation
Page 19

59
5959
GDPR Hype
GDPR is searched more
than Cyber Security
GDPR
Cyber Security
Page 20

60
6060
Page 21

61
6161
What does GDPR mean to our business? A lot!
The right to data portability allows individuals to obtain and reuse their
personal data for their own purposes across different services.
It allows them to move, copy or transfer personal data easily from one IT
environment to another in a safe and secure way, without hindrance to usability
Page 22

62
62
It will also change many processes and interaction methods.
Example first engagement with client and his consent to continue with the process:
Page 23

63
6363
Consent Management
One of the new tools needed to maintain compliance
Page 24

64
6464
Some organizations will have to appoint a DPO under
GDPR law
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/
The first point of contact for supervisory
authorities and for individuals whose data is
processed
Informs and advises the organization and its employees
about their obligations to comply with GDPR and other
data protection laws
Monitors compliance with GDPR and other data
protection laws, including managing internal data
protection activities
Advises on data protection impact assessments
Trains staff and conducts internal audits.
Page 25

65
6565
source: konfidas
GDPR and Israeli privacy act are touching the same areas
Page 26

66
6666
Eventually, it will come… So be prepared
Page 27

67
6767
Trek name:
Cyber Security Operations
Enforce patches
Applying to new devices
(watches, pumps, cars, etc.)
Embrace new technologies and
prepare for new vulnerabilities
Re-adjust cyber security program
Embrace
DevSecOps
Automate Cyber
Operations and Use
AIML
Page 28

68
6868
DevSecOps Manifesto:
Page 29

69
6969
DevSecOps tools - Embed SDLC (Secure Dev. life cycle) tools
into CICD:
• Static analysis tools
• Dynamic scanning (auto pen. tests)
• Embed operations data (logs, customer inputs) with security inputs
Page 30

70
70
70
Balance between business
needs and cyber, risk &
compliance needs
Page 31

71
71
71
Page 32

STKI Summit 2018 Cyber Governance Initiative

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to STKI Summit 2018 Cyber Governance Initiative

Similar to STKI Summit 2018 Cyber Governance Initiative (20)

More from Dr. Jimmy Schwarzkopf

More from Dr. Jimmy Schwarzkopf (20)

Recently uploaded

Recently uploaded (20)

STKI Summit 2018 Cyber Governance Initiative